topic Re: NAC Deployment Questionaire in Network Security

NAC Deployment Questionaire

adamgibs7 — Fri, 21 Feb 2020 12:19:50 GMT

Hello Dears,

I have a 2 No's NAC Manager and 1 No's NAC server, Our Network is Cisco three tier: Access> Distribution >Core. Distribution switch is doing inter vlan routing and layer 3 connecting (OSPF) between the core and the distribution and amoung the Distribution. We also have wireless controllers and vpn users.

All devices are from Cisco systems and supportable by NAC..

I have to deploy NAC In which mode ??? Please help, i have read abt it but still i wanna clear my doubts

L3 Inband VG

L3 Inband RG

L3 OOB VG

L3 OOB RG

Thanks

Re: NAC Deployment Questionaire

Nicolas Darchis — Mon, 02 May 2011 19:55:34 GMT

In band has the advantage that the CAS does the traffic filtering (only allowing given protocols). You can assign user roles,etc ... Inconvenient is that you are limiting bandwitdth by sending all traffic through the CAS.

Out of band has the advantage of bypassing the CAS once user is authenticated. Better for bandwitdh. But CAS cannot filter traffic anymore. For wireless in out of band, you cannot assign vlans depending on roles in NAC.

difference between RIP and VGW is smaller. In RIP, the CAS will be the gateway and wil route traffic.

There is no "go for this", it's a decision you make.

Re: NAC Deployment Questionaire

adamgibs7 — Wed, 04 May 2011 10:09:30 GMT

Hello Nicolas,

Thanks fo replying the post.

Question 1:

Layer 3 is deployed when CAS is hop away from users and not adjacent to CAS. When i thinking to place CAS and CAM on Core so i shld think abt layer 3 because all users will be accessing 1 hop away from the default gateway that is (Distribution Switch),so i shld forget abt layer 2 INBAND Real IP Gateway and virtual Gateway. Correct me if i m wrong ???????

Question 2

I m thinking to deploy in Layer 3 OOB RIP i have seen example on cisco website for this mode But there is no such configuration example for

Layer 3 OOB VG mode. Is it I m on the right path or better than this any deployment according to ur expierience Nicolas ????

Question 3: Can NAC be deployed in the following modes. Is it such types of Modes are there????????????????????????????

Layer 3 IB VG

Layer 3 IB RIP

Layer 3 OOB VG

Question 4:

We say that users Default Gateway will be NAC when we deployed in RIP.But In Cisco Configuration Example of layer 3 OOB RIP, There is no such interface configured for gateway?????????